The CISO has put you in charge of improving the security awareness and training program. The concern they want you to focus on is that it is unknown whether the training efforts have any effect or benefit. If you cannot establish proof of a positive ROSI, then the program will be terminated. Which of the following would be useful in establishing an effective evaluation procedure? Each correct answer represents a complete solution. Choose all that apply. A V Collect key security indicators that relate to insider security incidents over time B Have workers take a test 6 months after a training class C 0 Requiring workers to pay $ 10 for each security incident they are involved in D V Administering a quiz immediately after the awareness event E Taking attendance Posting a list of employees who cause a security incident on the primary bulletin board in F the break room